The vulnerability identified as CVE-2025-66142 affects the merkulove Comparimager for Elementor plugin, specifically versions up to 1.0.1. It is caused by missing authorization checks, which result in incorrectly configured access control security levels. This allows users with limited privileges to perform actions or access data beyond their intended permissions. The CVSS 3.1 base score is 5.4, reflecting a network attack vector with low complexity, requiring privileges, no user interaction, and impacts confidentiality and integrity to a limited extent without affecting availability.

Exploitation of this vulnerability could lead to unauthorized access or modification of data within the Comparimager for Elementor plugin environment. The impact is limited to confidentiality and integrity with no direct availability impact. Since the vulnerability requires some level of privileges, it is not exploitable by unauthenticated attackers. There are no reports of active exploitation in the wild.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisories for updates. Until a fix is released, restrict access to the plugin to trusted users only and review user permissions to minimize risk. Avoid granting unnecessary privileges that could be leveraged to exploit this missing authorization issue.